A min-entropy uncertainty relation for finite size cryptography 
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Apart from their foundational significance, entropic uncertainty relations play a central role in 
proving the security of quantum cryptographic protocols. Of particular interest are thereby relations 
in terms of the smooth min-entropy for BB84 and six-state encodings. Previously, strong uncertainty 
relations were obtained which are valid in the limit of large block lengths. Here, we prove a new 
uncertainty relation in terms of the smooth min-entropy that is only marginally less strong, but has 
the crucial property that it can be applied to rather small block lengths. This paves the way for 
a practical implementation of many cryptographic protocols. As part of our proof we show tight 
uncertainty relations for a family of Renyi entropies that may be of independent interest. 



Entropic uncertainty relations form a modern way to 
characterize the uncertainty inherent in several quantum 
measurements. As opposed to more traditional methods 
of capturing the notion of uncertainty, they have the ad- 
vantage that they are able to quantify uncertainty solely 
in terms of the measurements we consider, and are inde- 
pendent of the state to be measured. To see this clearly, 
let us explain the notion of entropic uncertainty in more 
detail (also, see [1] for a survey). Suppose we are given a 
state p on which we can make one of L possible measure- 
ments with outcomes labelled x £ X. Let p x \ p ,g denote 
the probability of observing outcome x when making the 
measurement labelled 9 on the state p. For each mea- 
surement, we can consider some form of entropy of the 
outcome distribution such as for example the Shannon 
entropy H(X|6 = 9) = -J2 x Px\ P ,8^og2Px\ P ,e- An en- 
tropic uncertainty relation in terms of the Shannon en- 
tropy is then determined by the average (pg = 1 / L) over 
the individual entropies. More precisely, such a relation 
states that for all states p 

i£H(x|e = 0) = H(x|e)>c, (i) 

6 

where c is a constant that depends solely on the mea- 
surements. For example, if p is a single qubit state, and 
we consider L = 2 measurements in the Pauli ax and 
o~ z eigenbases, we have c = | [2]. To see why for 
c > is indeed connected with uncertainty, note that if 
the outcome is certain with respect to some measurement 
9 on the state p (H(Y|0 = 6) = 0), then the outcome 
of at least one other measurement 9' ^ 9 is uncertain 
(H(X|9 = 9') > 0). Similarly, the larger the value of c, 
the more uncertain these outcomes are. The value of c 
thus give a natural measure of the incompatibility of dif- 
ferent sets of measurements. Strong uncertainty relations 
have the property that c is large. 

From a cryptographic perspective, uncertainty rela- 
tions in terms of the min-entropy H m j n (AT|9 = 6) = 
— logmaxj-p^ip g |23) are of particular interest, since the 



min-entropy determines how many random bits (key) can 
be extracted from X ||. In a cryptographic setting, it 
is thereby often interesting to consider a slight extension 
of the notion of uncertainty relations above. Namely, 
instead of measuring one state p, we imagine that an 
adversary prepares with some probability pk a state pk 
(labelled by some classical label K = k) which we sub- 
sequently measure. Since entropic uncertainty relations 
hold for any state, they do in particular hold for any 
state Pk that the adversary may have prepared. Yet, the 
distribution {p x \ke} over measurement outcomes may of 
course depend on fc. Uncertainty relations with respect 
to such classical side information K thus take the form 

H min (X|9if) > c' , (2) 

for some constant c' depending on the measurements we 
make. Averaging over bases O and classical information 
K, the conditional min-entropy is given by (see appendix) 

H m in(X\QK) = - \og^2p e ^2pk\em&x Px\ke ■ (3) 
e k 

For example, imagine that p is an n-qubit state and we 
perform one of the 2" possible measurements given by 
measuring each qubit independently in one of the two 
BB84 bases [4], i.e., in the eigenbasis of Pauli a x or a z . It 
is known that in this case c' = —n ■ log(l/2 + 1/(2^2)) ss 
n ■ 0.22 for any K. This is also optimal as there exists a 
state that attains this lower bound. 
Measurements in BB84 bases are indeed common in 
many quantum cryptographic protocols. In particular, 
they are used in two-party cryptographic protocols in 
the bounded [6] and noisy-storage model [THS] . These 
models allow for the secure implementation of any two- 
party cryptographic primitive under the assumption that 
the adversary's quantum memory device is bounded and 
imperfect. This includes interesting primitives such as 
oblivious transfer, bit commitment, and even secure iden- 
tification of e.g. a user to an ATM machine. The se- 
curity of all protocols in this model crucially rests on 
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the existence of uncertainty relations in terms of min- 
entropy [5HTT]. Yet, the value of d w n ■ 0.22 for BB84 
bases is usually too low to be cryptographically useful. 
In particular, a low value for d means that the adver- 
sary's memory must be very limited and/or noisy for 
security to be possible [5J [9] at all. Furthermore, a 
low value of d means that any experiment implementing 
such protocols can tolerate only a small amount of bit flip 
errors and losses [HI HUES- F° r instance, if p crr is the 
bit flip error on the channel connecting Alice and Bob, 
then security for the cryptographic primitive known as 
oblivious transfer is possible if d — h(p eTT ) > 0[H], 
where h(p) = — plog 2 p — (1 — p) log 2 (l — p) is the binary 
Shannon entropy. 

Motivated by this need to obtain a strong uncertainty 
relation for BB84 bases, that is, a large d, the au- 
thors of [B] considered the so-called smooth min-entropy 
H.^ in (X\<dK). Intuitively, a lower bound d on this quan- 
tity tells us that we do indeed have min-entropy at least 
d, except for some small error parameter s > 0. For- 
mally, this quantity is defined as (see appendix) 



sup H n 

p' 



p' 



(4) 



where p' is e-close to p in terms of the purified dis- 
tance [IB] . 

It turns out that at the expense of such a small error 
e, a much stronger uncertainty relation can indeed be 
obtained. In particular, it has been shown [5] that for 
measurements in the BB84 bases and any 5 € (0, |], 



where 



R £ mijl (X\@K)>n- 



exp 



-S 



128(2- 



logf) 2 



(5) 



(6) 



Using this relation in a cryptographic protocol only yields 
an additional error e in the overall security error, and it 
is widely employed in the protocols of [BJ El EH H2Tfl^] . 
From a theoretical (asymptotic) viewpoint, this uncer- 
tainty relation is certainly sufficient. Yet, when it comes 
to putting any of such protocols into a practical exper- 
iment it has a small caveat: whereas e decreases expo- 
nentially in the number of qubits n, for a large amount 
of uncertainty, i.e., d = 1/2 — 6 « 1/2, the convergence 
is extremely slow. For example, for 6 = 0.0106 [13] cor- 
responding to d = 0.4894, we need n > 2.39 x 10 s to 
even have e — 0.1! In an experiment using weak coher- 
ent pulses, with frequency of 1GHz and Poisson parame- 
ter p = 1 it takes approximately 2.5 seconds to generate 
such an n [13] if there are absolutely no losses of any kind. 
However, compared to the generation time, a more signif- 
icant inconvenience is that the classical post-processing 
of such large block lengths is time-consuming. 



RESULTS 

To implement aforementioned protocols, it would thus be 
desirable to have a relation that is useful for significantly 
smaller values of n. Here, we prove such a relation that 
makes a statement for any desirable fixed error e > 0. In 
particular, we show that for any n qubit quantum state 
p and measurements in BB84 bases 



where 

CBB84 



H^ ln (X|6i<Q > n ■ c BB8i 



max -[l + s-log(l + 2 s )l 

sG(0,l] s 



(7) 



-log -I • (8) 



At the first glance, it may be hard to see that cbbba 
is indeed large. However, applying it to the example 
from T3] (see above) by plugging in s = 0.1 demon- 
strates that for the same e = 0.1, cbbsa > 0.4894 when- 
ever n > 2.36 x 10 4 . Comparing this with calculations 
in the previous section, the required block length n is 
approximately 10~ 4 times smaller. Figure | provides a 
comparison of these two bounds. We see that even for 
large e, the required bound on the block length n given 
by ^ is large. 



FIG. 1: (Color online) This plot shows the minimal required 
block length n on a logarithmic scale of base 10, in order to 
achieve an error parameter e. The dashed curves are plot- 
ted for the previous known bound pb, while the solid lines 
are obtained from our new analysis Mb. The different colors 
represent the fixed values of the lower bound d, with values 
0.45, 0.46, 0.47, 0.48, and 0.49 respectively. As c' increases, 
the plotted bounds get relatively higher. 

Our relation can readily be applied to any BB84 based 
two-party protocols in the bounded (or noisy)-storage 
model, and enables experiments for significantly smaller- 
values of n. For example, it enables the experimental im- 
plementation of [16 with n — 2.5 x 10 5 instead of n > 10 9 
for the same error parameter e. 

Furthermore our relation can be extended to the case 
of six-state protocols, i.e., measurements in Pauli o~ Xl o~ z 
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and o y eigenbases as suggested in [TOl HH Q3] . For this 
case we obtain 



Rl in (X\QK)>n-c 6 , 



where 



cq := max 
»e(o,i] 



log 5 (1 



1 1 2 

— log^ 

sn 



(9) 



(10) 



The relevant a-Renyi entropy for a single qubit state pk 
(where k denotes some classical information associated 
with the state pk) is 



n a (x\@) 



1 



PfeiPfc 



a 



log Pe J2 



Px\ke 



ee{o,i} xe{o, 1} 



log 



This yields a similar improvement over the relation anal- 
ogous to ^ proven in [6]. 

A crucial step in our proof is to show tight uncertainty 
relations for conditional Renyi entropies of order a, de- 
noted by H a (A\B). These may be of independent inter- 
est. Previously, such relations were only known for single 
qudit measurements for a — > 1, a — 2, and a — > 00 (see 
e.g. [U [17l [18]). More precisely, we show that for mea- 
surements on n-qubit states p in BB84 bases, the min- 
imum values of the conditional Renyi entropies for any 
a 6 (1, 2] are 



Px\ke 

0e{O,l},:re{O,l} 



(15) 



Here p x \k9 ■— to(M x m pk), where M x \ s denotes the mea- 
surement operator 

H 9 |a;)(a;|H e , 



M 



(16) 



with H the Hadamard matrix. To minimize the a-Renyi 
entropy for values of a € (1, 2], it it sufficient to maximize 
the summation term. Defining 



p(x\e) f 



mmH a (Jf|6) p i„ = n ■ 
P 



log(l + 2°- 1 ) 
a - 1 



ee{0,l},a;G{0,l} 



(17) 



(11) 



where 

Ka(A\B) plp 
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we first rewrite p x \ke as functions of two variables: g x :— 
tr(a x pk) and g z := tr(a z pk)- The Bloch sphere condition 
for a qubit gives g x +g^+gl < — 1' which serves as 

a constraint in maximizing (17). Switching to spherical 



1 - a 



t T [p^ B (l A (g) p B ) 1_a ] . (12) coordinates and evaluating the partial derivatives of (|17[) 



according to multiple independent variables, we prove 



Similarly, for measurements in the six-state bases 

log3-log(l + 2 2 - Q ) 



R a (x\e) 



Pk\pk 



> 



1 



minH a (X|e) p i p = n 



1 



(13) 



1-a 
1 



log 



1 



■(2" +2) 



a 



2 l+a 

T [a-log(l + 2"- 1 )]. (18) 



PROOF 

Let us now explain the proof of our results. A technical 
derivation including all details may be found in the 
appendix. For simplicity, we restrict ourselves to the 
case of BB84 measurements. An extension for six-state 
protocols is analogous and can be found in the appendix. 
To obtain Q we proceed in four steps. First, we will 
prove a tight uncertainty relation in terms of the a- Renyi 
entropy when p is just an n = 1 qubit state. Second, we 
show how to extend this result to an uncertainty relation 
for n > 1 qubits, giving us (11). The third step is to 
reintroduce K as outlined in the introduction. Finally, 
we relate the Renyi entropies of order a £ (1,2] to the 
smooth min-entropy. 

Step 1-A single qubit uncertainty relation: 

For the case when A and B are classical the conditional 
a-Renyi entropy reduces to the simple form 



Moreover, the minimal a-Renyi entropy is achieved on 
an eigenstate of either measurement basis. 

Step 2 - A relation for n-qubits: To extend the one 
qubit uncertainty relation to multiple qubits, the central 
problem is to prove that the lower bound on the con- 
ditional entropy scales linearly with the block length n. 
This essentially implies that for a system of n qubits, the 
entanglement across qubits does not give rise to a lower 
minimal a-Renyi entropy. In our analysis, we show this 
by first considering the last qubit measured, conditioned 
on all the previous n — 1 measurement bases and values. 
That is, we consider a n-qubit normalized density oper- 
ator pABki where B denotes the last qubit and A the 
remaining n — 1 qubits, and write 



P(X B \0) 



PABk 



Px B \e B x A e A k > ( 19 ) 



where p XB \e BXA e A k = te{M XB \e B (T B ) with the correspond- 
ing normalized density operator 



E a (A\B) p]p = r 



1 



l0gJ2PB=bJ2PA=a\ 



(14) 



(T B = tr A 



M XA \0 A PABk Ml Al0A 



tr 



M xa \ 6a PABk Ml 



A \9 A 



(20) 
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Since the uncertainty relation for one qubit ( 18 ) holds 



for any density operator, it holds in particular for gb- 
By induction, it is then easily shown that the minimal 
entropy is additive. 

Step 3 - Classical side information K: After Steps 
1 and 2, we established a tight uncertainty relation for 
a binary string X n conditioned on the basis string 0™. 
Namely, we have 



H a (A"|e ? 



>Pk\pk 



> n- 



1 



-[a- log(l + 2- 1 )] . (21) 



for any n-qubit state pk- In this step, we obtain the 
conditioning with relation to classical side information 
K. In other words, we need to evaluate H. a (X\QK) p i p 
with 

P= Pe \9)(0\^2pk\e Pk Px\ek\x)(x\. 

0G{O.l}™ k xe{0.1}" 

(22) 

By observing the independence of and K, we show that 
the bounds of these values coincide, implying that 



an experimental implementation of bit commitment in 
the bounded/noisy-storage model. 

It is an interesting open question whether similarly strong 
relations can also be obtained with respect to quantum 
side information [TTJ [201 HI] • This would allow security 
statements for such protocols in terms of the quantum 
capacity [TT] of the storage device, rather than the clas- 
sical capacity [9] or the entanglement cost [22]. For the 
six-state case this has been done (implicitly) in [TT] for 
the special case of a Renyi type entropy of order a = 2, 
yielding however again a slightly weaker uncertainty re- 
lation as might be possible for other values of a € (1,2]. 
As the amount of uncertainty is the the key element in 
being able to tolerate experimental errors and losses in 
said protocols, it would be nice to extend our result to 
this setting. 
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R a (X\eK) plp >n- — - [q - log(l + 2"- 1 )] . (23) 



Step 4 - Relation to the min-entropy: As motivated 
previously, the final desired measure of entropy is the 
smooth min-entropy H^ nin (A|0A") p . A recent work [Tj5] 
has shown that a lower bound can be obtained for this 
quantity. Namely, we have for any state p and a € (1,2] 



H^ n (A|9A) p >H Q (A|eA) p | p - 



1 



1 



log- 



(24) 



This combined with ( 23 1 implies the claim 



W min (X\QK) p > 



1 , 

n ■ max - 1 

ae(o,i] s 

1 ^ 2 



a - log(l + 2 s )] 



(25) 



It is worth noting that as n — ¥ oo, the maximum is ob- 
tained for s — > 0, implying that as the system size ap- 
proaches infinity, the optimal bound is still given by ([5]). 
That is, in terms of a bound which comes from the Shan- 
non entropy. However, our analysis provides a better 
alternative to bound the smooth min-entropy for finite 
system sizes, and hence is more useful for practical im- 
plementations. 



CONCLUSIONS 



We have proven entropic uncertainty relations that pave 
the way for a practical implementation of BB84 and six- 
state protocols [5HTU1 rT2"HT4"] at small block length. In- 
deed, our relation has already been employed in |16j for 
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Appendix 

In this appendix, we provide the technical details that lead to our claims. In section A, the complete proof for the 
uncertainty relation for BB84 bases (measurements in eigenstates of Pauli a x and a z ) is presented. In section B, 
similar methods are used to derive bounds for six-state bases (measurements in eigenstates of Pauli a x , a y and a z ). 

We first restate the definitions of the relevant entropic quantities. Given any finite-dimensional Hilbert space H, 
let S<(T-L) denote the set of sub-normalized density operators on H, and S(H) denote the set of normalized density 
operators on %. For Ha and Hb, the conditional min-entropy of pab G S(Ha ® Hb) given ob € S(Hb) is defined 
as 

U mi n{A\B) pla := sup {A e R : 2~ A • l A ® a B > p AB } , (26) 
and the conditional min-entropy of A given B is defined as 

H min (A|5) p := sup U niin (A\B) pla . (27) 

<tbES(Hb) 

The smooth conditional min-entropy of A given B and e > is defined as 

W min (A\B) p := sup R nlin (A\B) p , , (28) 

p'eB'(p) 

where B € (pab) '■= S<{%a ® %b)|P = \/l — P 2 (p, pO — £ } is an £-ball in terms of the purified distance with 

F(P,P') ■= WVpVp'Wi + V(l - tr[p])(l - tr[p']) (29) 

the (generalized) fidelity [TS]. 

The conditional a-Renyi entropies are defined as 

R a (A\B) p{p : = ^—\ogtT[p a AB (lA® Pb) 1 -"] , (30) 

where (possible) inverses are understood as generalized inverses. Note that there exist also slightly different definitions 
of conditional a-Renyi entropies in the literature. 

A. UNCERTAINTY RELATION FOR BB84 MEASUREMENTS 

Step 1 : Single qubit relation 
For any qubit state p G 6>(C 2 ) we have to examine the quantities 

R a (x\e) plp = — ^io g p a (x\e) 

1 — a 

P a (X\Q) = trlp^ilx^pe) 1 -*] 
pxe = ^Pe ■Px\e\x){x\ ® \6){6\ 

Px\e = ti(M x \0p) , (31) 

with M x \g — H e \x) (x\H e , and H = ^ the Hadamard matrix. Since the choice of measurements is uniform, 

we get 

W) = J'Ej€i« ■ ( 32 ) 
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Theorem A. 1. Let p £ S(C 2 ), and a — 1 + s with s £ (0, 1]. Then we have for 

K a (X\G) plp > i[l + s -log(l + 2 s )] . 

Proof. We evaluate the term 



measurements as in (31) f/ia£ 



(33) 



0e{o,i} a;e{o,i} 

= ^NHO)(0|) 1+s +tr(p|l)(l|) 1+s +tr(p|+)(+|) 1+s + tr(p|-)(-|) 1 



1 



2 2+ S 
1 

22+* 



{[1 + tr(a 2 p)] i+s + [1 - tr(a^)] 1+s + [1 + tv(a x p)] 1+s + [1 - tr(a x p)] i+s } 
[(1 + z) 1+s + (1 - z) 1+s + (1 + x) 1+s + (1 - x) 1+s ] , 



where x := tr(cr a; p) and z := tv(o~ z p). For any one qubit state p, we have the Bloch sphere condition 

ti(a x p) 2 + tr(cr y p) 2 + tr(a z p) 2 < 1 . 
and can therefore parametrize x and z by polar coordinates 

x = r sin d>, z — r cos , 



(34) 
(35) 



(36) 



where r € [0, 1], and € [0, ?]. P Q (X|0) can then be rewritten as a function depending on the variables s, r, and 



Q(s,r,, 



2 2+, 



•[(1 + rcos0) i+s + (1 - rcos 



(37) 



f (1 + r sin 0) 1+5 + (1 - rsin0) 1+s ] . 
[cos 0(1 + r cos0) s — cos 0(1 — r cos <fi) s + sin 0(1 + rsin0) s — sin 0(1 — rsin0) s ] . (38) 



The partial differential of Q(s, r, 0) with respect to r becomes 

dQ(s,r, 0) = l + s 
dr ~ 2 2 + s 

dQ{s,r,<t>) 
dr 

attained at r = 1. The partial differential of <2(s,r, 0) with respect to at r = 1 becomes 
<9Q(s, 1,0) l + .s 



Since in the range of 0, sin0 and cos0 are positive, we obtain " v g^'^' 1 > 0, which implies that the maximum is 



dct> 



-[— sin 0(1 + cos 0) s + sin 0(1 — cos 0) s + cos 0(1 + sin0) s — cos 0(1 — sin0) s ] 
l + s 

— 7— {sin0[(l - cos0) s - (1 + cos0) s ] + cos0[(l + sin0) s - (1 - sin0) s ]} . 



(39) 



For a stationary point of Q(s,l,(/)), ( |39| is zero and the solution is obtained at three points: = 0, j, ^. The 
characteristics of the endpoints = 0,^ are the same, hence it suffices to analyze either. It remains to analyze the 
characteristic of these stationary points. To do so, we evaluate the second partial derivative at these points as a 
function of s 

a 2 Q( s ,i,0) 



his) 



a 2 Q( s ,i,0) 



1 + 5 

2 2+s 



4=0 



1 - 



1 + S 

2 l + s 



s - 2 s - 1 ) , s > 



(40) 



V2 



1 

T2 



-V2 



1 



- 1- 



72 



(41) 



To determine if the stationary point is a local minima or maxima, we show the positivity/negativity of these functions 
over the interval s € (0,1]. Note that /i(0) = —\ and /i(l) = 0, while /i(s) is always increasing since a ^ s - ) = 
2ttt [2 — (1 + s) In 2] > 0. Hence fi (s) is negative, implying the endpoints correspond to a local maxima. On the other 
hand, note that the second term in (41 1 is exactly of the form g(a, s) as stated in Lemma Cjljwith a = With this, 
we conclude that the point = ^ is a local minimum. This leaves the endpoints as the only candidates for optimal 
parameters that achieve the maxima of Q(s, 1, 0). Evaluating Q(s, 1, 0) then provides us the bound 



p 1+s (x\e)<Q(s,i,o) 



2 l+s 



(2 s + 1) 



and plugging this back into (31) gives (33) 



(42) 
□ 
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Step 2 : Relation for n-qubits 



The goal is to prove that for any n-qubit state measured independently on each qubit in BB84 bases, the minimal 
output a-Renyi entropy is additive. Let first n = 2 with the first system denoted by A and the second by B. We have 



p a (x A x B \e A e B ) = E poa,<>b E p* 



a,x b \6a,6e 



- ■ V r> a ■ - V n a 

o / j ^x a \8a o / j t> XB \x A , 



e A ,e E 



xa,8a 



where pq b \q a — pe B an d Pe B =o = Pe b =i = 1/2- Now assume that we have a one qubit upper bound 



2 ' E Px a \0a 

xa.Oa 



< C 



(43) 



(44) 



for P a (X\Q). Note that the second summation term in (43) corresponds to P a (X\Q) of the single qubit density 
operator 



a B = tv A 



Mx A \e A PAB Ka\9a 

te[M XA \ eA pab mI a19 J 



(45) 



where M XA \g A = U 8a \x a )(x a \H 6a ®Ib. Hence we have 



p a (x A x B \e A e B ) < 2 • E p*a\o a < 

xa,Sa 



(46) 



The following lemma generalizes this argument to arbitrary n. 

Lemma A. 1. For p E S((C 2 )® n ) measured independently on each qubit in BB84 bases, the minimal conditional 
a-Renyi entropy of X n with respect to 8" is additive. 



Proof. Consider 



p a {x n \Q n ) P \ P = E E p^ 

0"6{o,i}™ x™e{o,i}" 
= 2^' ^ ^ II''- " I 

S"S{0,1}" :c"e{0,l}" \i=l / 



(47) 



where Piix*- 1 ^- 1 — Px i \x i ~ 1 =x i - 1 ,e i - 1 =e i - 1 ,K=k f° r * > 2 and pi = p Xl \e 1 .K=k- Assuming the same upper bound as 
in (44) we get 



p a (x n \e n ) p[f 



i ( n - 1 \ a i 

e e ( n^v- 1 .*'- 1 ] ■ ^"i*"- 1 .*"- 1 

9 n £{0,l} n x n £{0,l} n \i=l / 



fn-\ 



< c 



E lift ^ 



e»- 1 ,x»- 1 e{o,x}' 1 - 1 \»=i 



(48) 



□ 



Combining this with the one qubit uncertainty relation derived before, we obtain the following. 

Corollary A. 1. For a = 1 + s with s E (0, 1], and p € <S((C 2 )®") measured independently on each qubit in BB84 
bases, we have 



U a (X n \Q n ) plp > n ■ i [1 + s - log(l + 2 s )] 



(49) 



Step 3 : Classical side information K 

In Corollary A[l] we have obtained an uncertainty relation H a (X n \<d n ) p \ p for any n-qubit states p. But generally 
we want to consider n-qubit states pk labelled with classical information K, and we need to make a relation to the 
quantity H a (X n \<d n K) p \ p for the state p = J^kPkPk- That is, the a-Renyi entropy is also conditioned on classical 
information K . This quantity is evaluated as 

H a (X n \e n K) plp = ^log^ E E 

k 0»e{O,i} n x"£{o,i}™ 

= Y^ l0g E^ E P*M* E Px»|9»,fc . (50) 
fc e™e{o,i}™ x"e{o,i}" 

where the difference is that now p^lif = fc) is conditioned on the classical information K — k. However, in our case 
0™ is chosen randomly regardless of what state is prepared. Thus p(Q n \K = k) = p(Q n ) = 2~™ and we get 

R a (X n \e n K) p]p = ^log^Pfe J2 Pe* E PZ"\e»,k 

k 0"e{O,l}'* a;"£{0,l} n 

> n- - [1 + s - log(l + 2 s )] . (51) 



Step 4 ■ Relation to the min- entropy 

After obtaining a bound on H a (X n \Q n K) p \ p , we now link this to a bound on H^ nin (X n \Q n K) p . It is shown in 
Theorem 7] that for pab € S(Hab), e > 0, and a G (1,2] 

H^ ln (A|S), > H a (^|S) p |, - log | . (52) 

Thus the smooth conditional min-entropy is lower bounded by general conditional a-Renyi entropies, with a correction 
term growing logarithmically in 1/e 2 . For the Shannon entropy (a 1) this term diverges, but considering a G (1, 2] 
the bound is very useful. Namely, the smooth conditional min-entropy of X n given Q n K is bounded to 

- Rf nin (X n \e n K) p > -H a (X n \e n K) p]p > max -[1 + a- log(l + 2 s )] - — log^ ■ (53) 
n n se(o,i] s sn e z 



Note that the maximum value of (53) is obtained for different values of s, as n and e varies. 



B: UNCERTAINTY RELATION FOR SIX-STATE MEASUREMENTS 

In this section, we make use of the same methods as in Appendix A. We derive an uncertainty relation for any n-qubit 
state measured independently on each qubit in six-state bases. For the single qubit version, we have to consider 

H a (A|6) p | p = — ?— log P a (X\0) 
1 1 — a 



P a (X\Q) = tr[pjte(tx®Pe) 



l—al 



PXB 3 



= 3 • J2p x \e\x)(x\ ® 
e,x 

p x]e = ti(N xle p) , (54) 



with N x \e = T 9 \x)(x\T e , and T = ^ | / J the matrix that cyclically permutes the eigenbases of Pauli a x , a y , 
and a 7 . 
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Theorem B. 1. Let p £ S(<C 2 ), and a — 1 + s with s G (0, 1]. Then we have for six-state measurements as in (54) 
that 



1 



R a (X\Q) plp > — log 



~(1 + 2 1 -) 



(55) 



Proof. We evaluate the term 



< 1+s (x\&) = I ■ Erf 



a;G{0,l} 9S{0,1,2} 



3- 2 ^E[( 1 +^) 1+s + ( 1 --^ 1+s ]' 



(56) 



where {xo, £i, £2} := {x, y, z} and Xi := tr(a a:i p). Parametrizing this in terms of spherical coordinates, we write 

xq = r sin 6 sin x% — rcos0sin#, X2 = rcos9 , (57) 



where < r < 1, < 6, 9 < The expression (56) can be rewritten in terms of these new coordinates as 



M(s,r,6,6) : =r^TT7{E [l + (-l) P ^in0sin0] 1+s + £ [1 + (-lfr cos 0sinfl] 1+s + ]T [1 + (-l) p cos 9} 1+s } . 

(58) 



p=0,l p=o,i 
Evaluating the partial differential of Q(s, r, 4>) with respect to r 



8M(s,r,< 
dr 



1 + s 1 

• sin # • {sin <^>[(1 + r sin 6 sin 0)' s — (1 — r sin sin ( 

3 2 1+s 

+ cos0[(l + r cos6su\9) s — (1 — r cos^sintf) 15 ]} . 



(59) 



Again we see that since in the range of 6, 9, all values of sines and cosines are positive, we obtain ^Mf^Jj^A > 
which implies the maximum is attained at r = 1. Subsequently, evaluating the partial derivative 

dM(s ,1,6,9) = 1 + * , 1 sin0 . {cos^n+sm^sinfl) 5 - (1 - sin0sin6») s l 
86 3 2 1+s 7 v 



- sin </>[(! + r cos ^sin^) 15 — (1 — r cos 6sm9) s }} , 



(60) 



gives the points 6 = 0, f , f as solutions. We continue by evaluating the second partial derivative at these points 



d 2 M(s, 1, 



d 2 M(s,l,6, 9) 



6=0 



• — L .sin0[2ssin0- [(1 + sin6») ;s - (l-sm<9) s 



1 + s 1 



{ S • [(1 + c)- 1 + (1 - c)- 1 ] - - [(1 + c) s - (1 - c) s ]} , (61) 



where c = ^7=*. By expanding in Taylor's series, the first equation is negative for s € (0,1], whereas the second 
equation is positive. Hence the maximum is obtained at 6 = 0. The last step is to evaluate 



dM(s,l,Q,6) _ 1 + s _ 1 sm6 |. r cos ^,[( 1 + sm?isin ^a_n _ sm sin6 ,) S ] 
3 2 i+s 



sin </>[(! + r cos sin 9) s — (1 — r cos </>sin(9) s ]} 



(62) 



But then this is of similar form as (39), and thus the maxima is obtained at 6 = 0. Evaluating M{s, 1,0,0) then 
results in the claim 



Pi+ s (X\9) < M(s, 1,0,0) = i(l + 2 x - s ) 



(63) 

□ 
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The additivity of minimal entropy holds by using the same argument as in Step 2 of Appendix A. Namely, given a 
string divided into parts A and B, where B denotes a single qubit system, the uncertainty relation for B holds for 
the state 



a B = tr A 



N XA \e A Pab N xaWa 

M^x A \9 A PAB NI a]6a }_ 



(64) 



where N, 



x A \e A 



T dA \x A )(x A \T eA ® Is- By exactly the same arguments as in Steps 3 and 4 in Appendix A, the 
smooth conditional min-entropy of the string X n 6 {0, 1}" conditioned on the basis 6 n € {0,2}™ and the classical 
side information K can then be bounded by 



Hf nin (A"|8"K) p > ~H a (X n \Q n K) Mp > max ~ log 



1 

sn 



, 2 



(65) 



C: TECHNICAL LEMMAS 



Lemma C. 1. Given the function g :M. x 



](a,s) := s • [(1 + a) 3 - 1 + (1 - a) 



s-ll 



[(l + a) s -(l-a) s ] 



(66) 



TTien g(a, s) > /or a € [0, 1) and s e (0, 1] . 

Proof. Since a lies within the convergence radius of the function (1 ± a) s , we expand the function in Taylor's series 



s ■ [(1 + a)'-' + (1 - a) 5 - 1 ] - -(1 + a) s - (1 - a) 



= 2s • 



= 2s • 



= 2s ■ 



(s-l)(s-2)...(s-n) 



2as + 2 ^ 



s(s - l)...(s - n+ 1) 



n— 3,5. 



^ (s-l)(s-2)...(s-n) a „ ( S -l)( 3 -2)...( 8 -n + l) an _ 1 



n=2,4... n=3,5... 

( S -l)( fl -2)...(s-n) _ ^ (s-l)(s-2)...( S -j) 



E 

n=2,4... 



J=2,4. 



Cj + i) 



2s- J2 (s-l)(s-2)...(s 



(n + 1)! 



> 



(67) 



The first equality holds by a straightforward expansion of Taylor's series, the second equality by extracting 2s and 
absorbing - into the second summation term, the third equality follows from redefining the summation variable 
j = n — 1, and the last inequality follows because (s — l)...(s — n) > for s £ (0, 1] and n being an even integer. □ 
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